[sergo] Sergo Report: STABLE-71 cached-vein node_filter_too_narrow + 7-linter new-explore - 2026-09-16

[github-actions[bot]]

Executive summary

Run 68. Registry held stable at 71 registered analyzers — no new linter this cycle. All 7 issues open going into this run were confirmed still open and unfixed via gh api, so no reverse-phantom reconciliation was needed this time. This run exploration produced 1 code-verified, high-confidence finding: two CI-enforced linters (globwalkignorederror, strconvparseignorederror) share an identical AssignStmt-only blind spot that a sibling linter (jsonmarshalignoredeerror) already fixed years ago — a clean textbook case of the node_filter_too_narrow pattern class recurring in never-before-audited code.

Tool and registry status

• Serena: 24 tools, stable, no change.
• activate_project OK for go/typescript/bash.
• Registry: grep -c Analyzer, pkg/linters/registry.go = 71, unchanged from R67.
• doc.go header (All 71 active analyzers) still matches the registry count — no doc-sync gap.
• One false alarm ruled out: gh api commits?path=pkg/linters/registry.go surfaced a manualpathconcat commit in recent history, but that linter was already registered and twice-audited (issues manualpathconcat: 2-operand embedded-slash literal is never detected #57052, manualpathconcat: plus-equals form of manual path concatenation is never detected #54983 both closed-completed) — not a new addition.

Strategy: 50/50 split

Cached vein (50%): Reused the node_filter_too_narrow pattern class, first documented from jsonmarshalignoredeerror (issue #39982: an AssignStmt-only node filter misses a bare ExprStmt call that discards all return values with no assignment at all). Searched every linter in pkg/linters/ for the exact nodeFilter AssignStmt-only shape used by that historical bug, to check whether the fix had been propagated to siblings sharing the same design.

New exploration (50%): First-ever solo audit of 7 linters that had never individually been the subject of a bug-report issue — globwalkignorederror, strconvparseignorederror, sprintferrorsnew, regexpcompileinfunction, sortslice, stringreplaceminusone, rawloginlib. These had only appeared in batch enforce-readiness issues or as passing mentions, never a dedicated deep read.

Targets: find at least 1 code-verified, non-duplicate finding; avoid re-filing anything already tracked or already ruled intentional.

Findings

1. globwalkignorederror + strconvparseignorederror: AssignStmt-only filter misses bare ExprStmt discards (filed as issue, see below)

Both linters register only AssignStmt and require the exact v, _ colon-equals f() shape (Lhs len 2, Rhs len 1, Lhs index 1 blank). Neither has a branch for a bare call statement — os.ReadDir(dir) or strconv.Atoi(s) used as a standalone ExprStmt — which is legal Go and silently drops every return value, an even more complete version of the exact failure both linters exist to catch. The sibling jsonmarshalignoredeerror hit this identical gap (issue #39982) and was fixed by adding an ExprStmt case (checkDiscardedJSONExpr). Neither globwalkignorederror nor strconvparseignorederror has that branch, and neither has any ExprStmt test fixture. Both are wired into .github/workflows/cgo.yml LINTER_FLAGS for native and wasm CI with -test=false — they are meant to be a complete gate. No live production site currently triggers this (checked via grep across pkg/), so it is a latent enforcement hole rather than an active false negative, but it is a silent gap in an already-enforced check.

2. Ruled out: sprintferrorsnew variable-indirection gap — intentional, not filed

Grepping errors.New with a bare identifier argument across pkg/ turned up 6 live production sites (pkg/cli/grype.go:221, pkg/cli/grant.go:153, pkg/workflow/engine.go:695, pkg/workflow/engine_definition.go:655, pkg/workflow/engine_inline_definition_validation.go:74, pkg/workflow/runtime_validation.go:93) where a fmt.Sprintf result is assigned to a variable and then passed to errors.New, escaping detection because the linter only matches a directly-nested fmt.Sprintf(...) call. This looked promising at first, but the testdata for this linter explicitly documents the behavior as deliberate scope (goodVariable fixture, comment: uses a pre-built string variable, not flagged by this linter). Filing this as a bug would contradict a design decision already made and recorded in the test suite, so it was set aside rather than filed.

3. Audited clean: rawloginlib, sortslice, regexpcompileinfunction, stringreplaceminusone — all type-resolved via types.PkgName (immune to the syntactic_stdlib_match class), no ancestor-walk scope-boundary bugs, no state-reset-across-blocks issues.

Task generated

Add an ExprStmt branch to globwalkignorederror and strconvparseignorederror, mirroring the existing checkDiscardedJSONExpr pattern in jsonmarshalignoredeerror, plus one ExprStmt-shaped testdata case per linter to lock in coverage.

Issue created

globwalkignorederror + strconvparseignorederror: AssignStmt-only filter misses bare ExprStmt discards (sg68a1, labeled sergo)

Metrics this run

• Findings: 4 (1 filed, 1 ruled-out-as-intentional, 2 clean-audit confirmations bundled)
• Tasks created: 1
• Issues created: 1 (of max 3)
• Success score: 8/10

Historical context

• Total runs: 68
• Total findings to date: 444
• Total tasks to date: 118
• Average success score: 8.79

Open sergo-labeled issues carried into next run (8 total): sg68a1 (new), sg67a2 (#61024, blankassigncomma allow-list gap), sg67a1 (#61023, nolint space-prefix directive still silently dropped), sg66a1 (#60738, bufioscannererunchecked block-scope gap), sg64a1 (#60367, slicemakezerolength var-vs-make), sg63a1 (#60170, bufferresetbeforereuse block isolation), sg62a1 (#59875, manualmutexunlock 2+-level selector collapse), sg61a1 (#59627, 4-linter main-guard gap).

Recommendations and next-run focus

• Re-check all 8 open issues for closures or reverse-phantom auto-expiry (13 linters build SuggestedFix TextEdits without HasOverlappingComment guard (silent comment deletion on -fix) #58376 and internal/nolint: HasDirectiveForLinter ignores space-prefixed nolint directives #59122 have both shown this pattern before — closed/not_planned while the underlying bug remained live).
• If the registry grows past 71, audit the new linter fresh before anything else.
• The node_filter_too_narrow vein may not be fully exhausted — worth a broader sweep for any linter using a single narrow nodeFilter where a semantically-equivalent alternate AST shape (bare statement, different assignment arity, etc.) could carry the same violation invisibly.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by 🤖 Sergo - Serena Go Expert · claude · agent · 320.4 AIC · ⌖ 7.91 AIC · ⊞ 6.8K · ◷

• expires on Sep 16, 2026, 8:00 PM UTC-08:00

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-09-17T04:00:06.225Z.

Closed by Workflow